undefined | Better HN

0 pointshsbauauvhabzb1y ago0 comments

How does that bypass 802.1x? Are the 802.1x packets are responded to by the official modem still? I was under the impression all packets were encrypted or signed with 802.1x, but Ive never had to implement or test it so I could be wrong.

0 comments

toast01y ago

802.1x is a secure login procedure, and then the port is open until link is dropped. There's no encryption or authentication per packet (it would be way too expensive), and if you put a switch between the ont and the modem, when you disconnect the modem, the ont doesn't see the link drop.

Managed switches or software ethernet bridges don't always propigate 802.1x packets, but unmanaged switches don't care.

throw0101c1y ago

> There's no encryption or authentication per packet (it would be way too expensive) […]

It is possible to tie together 802.1X and MACsec, and plenty of (Ethernet) chipsets can do MACsec at wire speed, even up to 400G and 800G:

* https://www.arista.com/assets/data/pdf/Datasheets/7800R3_MAC...

* https://www.juniper.net/us/en/solutions/400g-and-800g.html

I don't know the telco space well enough to know if there's a MACsec-equivalent for GPON, but given the 'only' 25G speeds involved I doubt it would be much of a challenge.

j / k navigate · click thread line to collapse